R. Kinney Williams
December 10, 2006
Your Financial Institution need an affordable Internet security
Our clients in 41 states rely on
to ensure their IT security settings, as well as
meeting the independent diagnostic test
requirements of FDIC, OCC, OTS, FRB, and NCUA, which provides
Gramm-Leach Bliley Act 501(b).
The VISTA penetration study and
Internet security test is an affordable-sophisticated process than
goes far beyond the simple
scanning of ports and
a hacker's perspective, which will help
you identify real-world weaknesses. For more information, give Kinney Williams a call
today at 806-798-7119 or visit
FYI - U.S. warns of
possible al-Qaida financial cyberattack- The U.S. government warned
American private financial services on Thursday of an al-Qaida call
for a cyberattack against online stock trading and banking Web sites
beginning on Friday, a source said. The source, a person familiar
with the warning, said the Islamic militant group aimed to penetrate
and destroy the databases of the U.S. financial sites. The
Department of Homeland Security confirmed an alert had been
distributed but said there was no reason to believe the threat was
FYI - New Rules Make
Firms Track E-Mails, IMs - U.S. companies will need to keep track of
all the e-mails, instant messages and other electronic documents
generated by their employees thanks to new federal rules that go
into effect Friday, legal experts say. The rules, approved by the
Supreme Court in April, require companies and other entities
involved in federal litigation to produce "electronically stored
information" as part of the discovery process, when evidence is
shared by both sides before a trial.
FYI - Federal Rules May
Not Fully Secure Online Banking Sites - IT execs say banks and
credit unions need more than strong authentication - Financial
institutions that truly want to bolster their online security need
to look beyond the federal guidelines on end-user authentication
that go into effect Jan. 1, IT managers and analysts said last week.
FYI - Banks face growing
threat of identity theft from insiders - Banks are pouring money
into building formidable defenses against computer hackers, but are
only just waking up to what may be a bigger threat--the physical
theft of client information by people in the office.
FYI - Community America
Says At Least 12 Customers Affected - Several people who went online
Friday to do some banking wound up victims of a scam, officials
said. Community America Credit Union confirmed to KMBC that a hacker
managed to redirect people from the company's Web site to a phony
FYI - Phishing attacks
now using phone calls - And consumers thought they were safe by not
clicking on links in unsolicited e-mails. Now comes a new batch of
phishing scams that rely on an old tool - the phone - to trick
people into giving away their personal information. Vishing has
emerged as a new threat with the rise of Voice over Internet
Protocol, technology that allows cheap and anonymous Internet calls.
FYI - Linkin Park,
national security mash-up - A woman is accused of using a computer
at a national laboratory to hack into a cell phone company's Web
site to get a number for Chester Bennington, lead singer of the rock
group Linkin Park.
FYI - Met Police in
laptop theft security flap - Three laptops, containing the payroll
and pension details of more than 15,000 Met Police officers, have
been nicked from the offices of LogicaCMG, the outsourcing firm that
handles the payments.
FYI - Stolen laptop has
science centre's membership list - Ontario Science Centre officials
are urging its members to remain confident that their personal
information is safe after a laptop was recently stolen from the
popular city attraction.
FYI - Women alerted to
ID theft risk - Stolen computers had health data - More than 7,500
Hoosier women are at risk of identity theft after two computers
containing protected health information collected for the state were
stolen earlier this month.
Return to the top
of the newsletter
WEB SITE COMPLIANCE -
Generally, Internet web sites are considered advertising by the
regulatory agencies. In some cases, the regulations contain special
rules for multiple-page advertisements. It is not yet clear what
would constitute a single "page" in the context of the
Internet or on-line text. Thus, institutions should carefully review
their on-line advertisements in an effort to minimize compliance
In addition, Internet or other systems in which a credit application
can be made on-line may be considered "places of business"
under HUD's rules prescribing lobby notices. Thus, institutions may
want to consider including the "lobby notice,"
particularly in the case of interactive systems that accept
the top of the newsletter
INFORMATION TECHNOLOGY SECURITY -
our series on the FFIEC interagency Information Security
SYSTEMS DEVELOPMENT, ACQUISITION, AND MAINTENANCE - HOST
AND USER EQUIPMENT ACQUISITION AND MAINTENANCE
Many financial institutions use commercial off-the-shelf (COTS)
software for operating systems and applications. COTS systems
generally provide more functions than are required for the specific
purposes for which it is employed. For example, a default
installation of a server operating system may install mail, Web, and
file-sharing services on a system whose sole function is a DNS
server. Unnecessary software and services represent a potential
security weakness. Their presence increases the potential number of
discovered and undiscovered vulnerabilities present in the system.
Additionally, system administrators may not install patches or
monitor the unused software and services to the same degree as
operational software and services. Protection against those risks
begins when the systems are constructed and software installed
through a process that is referred to as hardening a system.
When deploying off-the-shelf software, management should harden the
resulting system. Hardening includes the following actions:
! Determining the purpose of the system and minimum software and
! Documenting the minimum hardware, software and services to be
included on the system;
! Installing the minimum hardware, software, and services necessary
to meet the requirements using a documented installation procedure;
! Installing necessary patches;
! Installing the most secure and up-to-date versions of
! Configuring privilege and access controls by first denying all,
then granting back the minimum necessary to each user;
! Configuring security settings as appropriate, enabling allowed
activity, and disallowing other activity;
! Enabling logging;
! Creating cryptographic hashes of key files;
! Archiving the configuration and checksums in secure storage prior
to system deployment;
! Testing the system to ensure a secure configuration;
! Using secure replication procedures for additional, identically
configured systems, making configuration changes on a case-by-case
! Changing all default passwords; and
! Testing the resulting systems.
After deployment, the COTS systems may need updating with current
security patches. Additionally, the systems should be periodically
audited to ensure that the software present on the systems is
authorized and properly configured.
Return to the top of the
G. APPLICATION SECURITY
4. Determine if access to sensitive information and processes
require appropriate authentication and verification of authorized
use before access is granted.
Return to the top of
INTERNET PRIVACY - We continue
our series listing the regulatory-privacy examination questions.
When you answer the question each week, you will help ensure
compliance with the privacy regulations.
30. Does the institution allow the
consumer to opt out at any time? [§7(f)]
31. Does the institution continue to honor the consumer's opt out
direction until revoked by the consumer in writing, or, if the
consumer agrees, electronically? [§7(g)(1)]
NETWORK SECURITY TESTING - IT
examination guidelines require financial institutions to annually
conduct an independent internal-network penetration test.
With the Gramm-Leach-Bliley and the regulator's IT security
concerns, it is imperative to take a professional auditor's approach
to annually testing your internal connections to your network.
For more information about our independent-internal testing,
|PLEASE NOTE: Some
of the above links may have expired, especially those from news
organizations. We may have a copy of the article, so please e-mail
us at firstname.lastname@example.org if we
can be of assistance.